v3.21.0-beta.0

Bug Fixes

• increase webhook latency buckets up to 10 seconds (#4037) #4037 (David Blum)
• removing readinessprobe for webhook at start of the pod (#4059) #4059 (Jaydip Gabani)

Chores

• bump golang from ee7ff13 to 10f549d in /test/export/fake-reader (#4046) #4046 (dependabot[bot])
• bump the all group with 2 updates (#4044) #4044 (dependabot[bot])
• bump golang from ee7ff13 to 10f549d in /test/export/fake-subscriber (#4045) #4045 (dependabot[bot])
• bump golang from 10f549d to 69adc37 in /test/export/fake-subscriber (#4053) #4053 (dependabot[bot])
• bump golang from 10f549d to 69adc37 in /test/export/fake-reader (#4052) #4052 (dependabot[bot])
• Patch docs for 3.19.3 release (#4056) #4056 (github-actions[bot])
• bump the all group across 1 directory with 2 updates (#4066) #4066 (dependabot[bot])
• bump kubectl from v1.33.2 to v1.33.3 (#4063) #4063 (dependabot[bot])
• bump the k8s group with 5 updates (#4062) #4062 (dependabot[bot])
• Prepare v3.21.0-beta.0 release (#4068) #4068 (github-actions[bot])

v3.20.0

Notable Changes

• 💾 A new driver to export violations on disk.
• 🎓 VAP integration is beta and enabled by default, hence VAP/VAPB resources will be generated by default for CT/C with K8sNativeValidation engine with CEL code.
• 🔗 A new Connection CRD replaced ConfigMap in order to establish connections with export backends.

Features

• mapping dryrun to audit in vapb (#3915) #3915 (Jaydip Gabani)
• adding driver to export to disk (#3832) #3832 (Jaydip Gabani)
• Graduating VAP generation to beta (#3995) #3995 (Jaydip Gabani)
• Export Connection CR (#3999) #3999 (Noah Reisch)

Bug Fixes

• removing readinessprobe for webhook at start of the pod (#4059) (#4065) #4065 (Jaydip Gabani)
• only enabling CEL driver with flag value (#3900) #3900 (Jaydip Gabani)
• error on deleting GK resources when delete operation is enabled (#3921) #3921 (Jaydip Gabani)
• scope of webhook configurations (#3676) #3676 (plavy)
• making sure latest CT version is updated in CT controller to avoid writing errors (#3983) #3983 (Jaydip Gabani)
• add RBAC for finalizers when running with OwnerReferencesPermissionEnforcement admission plugin (#3961) #3961 (Jaydip Gabani)
• unreliable webhook behaviour on gatekeeper pod startup and shutdown (#3780) #3780 (Benjamin Ritter)
• removing connection from map before closing it to avoid locking on latest connection update (#3946) #3946 (Jaydip Gabani)
• making sure VAPB is only deleted for constraints if it was enabled (#4034) #4034 (Jaydip Gabani)
• disk export path to handle dir deletes (#4021) #4021 (Noah Reisch)

Documentation

• adding opa v1 docs and tests (#3908) #3908 (Jaydip Gabani)
• adding available variables and updating faq (#3927) #3927 (Jaydip Gabani)
• Add Flags Reference (#3782) #3782 (Ian Stanton)

Continuous Integration

• bumping k8s version in testing and crd.Dockerfile (#3925) #3925 (Jaydip Gabani)
• release checklist (#3990) #3990 (Sertaç Özercan)

Chores

• Prepare v3.20.0 release (#4067) #4067 (github-actions[bot])
• bump golang from 75e6700 to 00eccd4 in /test/externaldata/dummy-provider (#3914) #3914 (dependabot[bot])
• bump golang from 75e6700 to 00eccd4 in /test/image (#3913) #3913 (dependabot[bot])
• bump the all group with 2 updates (#3912) #3912 (dependabot[bot])
• bump golang from 75e6700 to 00eccd4 (#3911) #3911 (dependabot[bot])
• bump golang from 75e6700 to 00eccd4 in /build/tooling (#3910) #3910 (dependabot[bot])
• Add pods/resize subresource to mutating and validating webhooks (#3778) #3778 (Ian Stanton)
• bump golang.org/x/net from 0.37.0 to 0.38.0 (#3920) #3920 (dependabot[bot])
• bump codecov/codecov-action from 5.4.0 to 5.4.2 in the all group (#3924) #3924 (dependabot[bot])
• bump http-proxy-middleware from 2.0.7 to 2.0.9 in /website (#3922) #3922 (dependabot[bot])
• adding helm variable for mutating subresources (#3916) #3916 (Jaydip Gabani)
• Patch docs for 3.19.1 release (#3937) #3937 (github-actions[bot])
• Patch docs for 3.18.3 release (#3938) #3938 (github-actions[bot])
• bump the all group with 2 updates (#3940) #3940 (dependabot[bot])
• bump the k8s group with 5 updates (#3939) #3939 (dependabot[bot])
• removing gator test alpha note from gator test --help (#3943) #3943 (Martin Alexander)
• bump the all group with 2 updates (#3951) #3951 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/export/fake-reader (#3955) #3955 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm (#3957) #3957 (dependabot[bot])
• bump actions/upload-artifact from 4.6.0 to 4.6.2 in the all group (#3959) #3959 (dependabot[bot])
  ...

v3.20.0-rc.1

Bug Fixes

• removing readinessprobe for webhook at start of the pod (#4059) (#4065) #4065 (Jaydip Gabani)

v3.19.3

Bug Fixes

• making sure VAPB is only deleted for constraints if it was enabled (#4034) (#4039) #4039 (Jaydip Gabani)

Chores

• Prepare v3.19.3 release (#4054) #4054 (github-actions[bot])

v3.20.0-rc.0

Features

• mapping dryrun to audit in vapb (#3915) #3915 (Jaydip Gabani)
• adding driver to export to disk (#3832) #3832 (Jaydip Gabani)
• Graduating VAP generation to beta (#3995) #3995 (Jaydip Gabani)
• Export Connection CR (#3999) #3999 (Noah Reisch)

Bug Fixes

• only enabling CEL driver with flag value (#3900) #3900 (Jaydip Gabani)
• error on deleting GK resources when delete operation is enabled (#3921) #3921 (Jaydip Gabani)
• scope of webhook configurations (#3676) #3676 (plavy)
• making sure latest CT version is updated in CT controller to avoid writing errors (#3983) #3983 (Jaydip Gabani)
• add RBAC for finalizers when running with OwnerReferencesPermissionEnforcement admission plugin (#3961) #3961 (Jaydip Gabani)
• unreliable webhook behaviour on gatekeeper pod startup and shutdown (#3780) #3780 (Benjamin Ritter)
• removing connection from map before closing it to avoid locking on latest connection update (#3946) #3946 (Jaydip Gabani)
• making sure VAPB is only deleted for constraints if it was enabled (#4034) #4034 (Jaydip Gabani)
• disk export path to handle dir deletes (#4021) #4021 (Noah Reisch)

Documentation

• adding opa v1 docs and tests (#3908) #3908 (Jaydip Gabani)
• adding available variables and updating faq (#3927) #3927 (Jaydip Gabani)
• Add Flags Reference (#3782) #3782 (Ian Stanton)

Continuous Integration

• bumping k8s version in testing and crd.Dockerfile (#3925) #3925 (Jaydip Gabani)
• release checklist (#3990) #3990 (Sertaç Özercan)

Chores

• bump golang from 75e6700 to 00eccd4 in /test/externaldata/dummy-provider (#3914) #3914 (dependabot[bot])
• bump golang from 75e6700 to 00eccd4 in /test/image (#3913) #3913 (dependabot[bot])
• bump the all group with 2 updates (#3912) #3912 (dependabot[bot])
• bump golang from 75e6700 to 00eccd4 (#3911) #3911 (dependabot[bot])
• bump golang from 75e6700 to 00eccd4 in /build/tooling (#3910) #3910 (dependabot[bot])
• Add pods/resize subresource to mutating and validating webhooks (#3778) #3778 (Ian Stanton)
• bump golang.org/x/net from 0.37.0 to 0.38.0 (#3920) #3920 (dependabot[bot])
• bump codecov/codecov-action from 5.4.0 to 5.4.2 in the all group (#3924) #3924 (dependabot[bot])
• bump http-proxy-middleware from 2.0.7 to 2.0.9 in /website (#3922) #3922 (dependabot[bot])
• adding helm variable for mutating subresources (#3916) #3916 (Jaydip Gabani)
• Patch docs for 3.19.1 release (#3937) #3937 (github-actions[bot])
• Patch docs for 3.18.3 release (#3938) #3938 (github-actions[bot])
• bump the all group with 2 updates (#3940) #3940 (dependabot[bot])
• bump the k8s group with 5 updates (#3939) #3939 (dependabot[bot])
• removing gator test alpha note from gator test --help (#3943) #3943 (Martin Alexander)
• bump the all group with 2 updates (#3951) #3951 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/export/fake-reader (#3955) #3955 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm (#3957) #3957 (dependabot[bot])
• bump actions/upload-artifact from 4.6.0 to 4.6.2 in the all group (#3959) #3959 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/externaldata/dummy-provider (#3958) #3958 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/export/fake-subscriber (#3956) #3956 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm in /build/tooling (#3954) #3954 (dependabot[bot])
• bump golang from 1.24-bookworm to 1.24.2-bookworm in /test/image (#3953) #3953 ([...

v3.19.2

⚠ Warning: Operation generate is now required to guard CRD and VAP/VAPB generation. Please update your singleton deployment (e.g. gatekeeper-audit) to include --operation=generate. If you are not using audit, you need to add it to the controller manager deployment. https://open-policy-agent.github.io/gatekeeper/website/docs/operations/#generation

Chores

• bump opa to 1.5.1 and kubectl to 1.33.1 (#4001) #4001 (Jaydip Gabani)
• Prepare v3.19.2 release (#4011) #4011 (github-actions[bot])

v3.19.1

⚠ Warning: Operation generate is now required to guard CRD and VAP/VAPB generation. Please update your singleton deployment (e.g. gatekeeper-audit) to include --operation=generate. If you are not using audit, you need to add it to the controller manager deployment. https://open-policy-agent.github.io/gatekeeper/website/docs/operations/#generation

Bug Fixes

• error on deleting GK resources when delete operation is enabled CP(#3921) (#3929) #3929 (Jaydip Gabani)

Continuous Integration

• bumping k8s version in testing and crd.Dockerfile CP(#3925) (#3933) #3933 (Jaydip Gabani)

Chores

• Prepare v3.19.1 release (#3934) #3934 (github-actions[bot])

v3.18.3

⚠ Warning: Operation generate is now required to guard CRD and VAP/VAPB generation. Please update your singleton deployment (e.g. gatekeeper-audit) to include --operation=generate. If you are not using audit, you need to add it to the controller manager deployment. https://open-policy-agent.github.io/gatekeeper/website/docs/operations/#generation

Bug Fixes

• CP(#3921) CP(#3857) CP(#3802) CP(#3925) (#3930) #3930 (Jaydip Gabani)

Chores

• Prepare v3.18.3 release (#3936) #3936 (github-actions[bot])

v3.20.0-beta.0

Bug Fixes

• updating golang version in subscriber dockerfile (#3876) #3876 (Jaydip Gabani)

Continuous Integration

• cleaning up disk in release workflow to avoid running out of space (#3877) #3877 (Jaydip Gabani)

Chores

• bumping opa to 1.3.0 from 1.2.0 (#3882) #3882 (Jaydip Gabani)
• bump kubectl from v1.32.2 to v1.32.3 (#3890) #3890 (dependabot[bot])
• bump crate-ci/typos from 1.30.3 to 1.31.0 in the all group (#3888) #3888 (dependabot[bot])
• bump distroless/static-debian12 from 95ea148 to 3d0f463 in /test/externaldata/dummy-provider (#3886) #3886 (dependabot[bot])
• bump distroless/static-debian12 from 95ea148 to 3d0f463 (#3889) #3889 (dependabot[bot])
• bumping protobuf and fixing lint memory issue in GH runner (#3893) #3893 (Jaydip Gabani)
• bump google.golang.org/grpc from 1.71.0 to 1.71.1 (#3899) #3899 (dependabot[bot])
• bump the all group with 3 updates (#3894) #3894 (dependabot[bot])
• bump golang from fa1a01d to 75e6700 (#3898) #3898 (dependabot[bot])
• bump golang from fa1a01d to 75e6700 in /test/image (#3897) #3897 (dependabot[bot])
• bump golang from fa1a01d to 75e6700 in /build/tooling (#3896) #3896 (dependabot[bot])
• bump golang from fa1a01d to 75e6700 in /test/externaldata/dummy-provider (#3895) #3895 (dependabot[bot])
• Prepare v3.20.0-beta.0 release (#3904) #3904 (github-actions[bot])

v3.19.0

⚠ Warning: Operation generate is now required to guard CRD and VAP/VAPB generation. Please update your singleton deployment (e.g. gatekeeper-audit) to include --operation=generate. If you are not using audit, you need to add it to the controller manager deployment. https://open-policy-agent.github.io/gatekeeper/website/docs/operations/#generation

Notable Changes

• 🛡️OPA rego v1 syntax is available in Gatekeeper ConstraintTemplates. Find out more here.
• 📤Updated Pub/Sub mechanism to generalized export mechanism to enable additional backends such as disk to export violations.

Features

• feat: gator test --deny-only flag (#3809) (Steeve)
• feat: Update Rego driver to support rego.v1 (#3873)(Charlie Egan]

Bug Fixes

• adding a comment to clean up disk space in runner (CP: 3877) (#3878) #3878 (Jaydip Gabani)
• Add flag to enable/disable referential constraints (#3701) (David Lee)
• bumping frameworks to fix GO-2025-3372 (#3810) (Jaydip Gabani)
• fixing nil pointer error when converting VAPB from v1beta1 to v1 (#3754) (Jaydip Gabani)
• parse namespace from oldObject when processing a DELETE operation (#3837) (Clément Nussbaumer)
• replace plus character with underscore in version label (#3742) (Filippo Rossi)

Documentation

• Add connect to operations (#3785) (Martin Alexander)
• Use markdown emphasize-syntax in demo documentation (#3786) (Sascha)
• addressing deny-only gator flag nits (#3870) (Jaydip Gabani)

Chores

• Prepare v3.19.0 release (#3903) #3903 (github-actions[bot])
• Prepare v3.19.0-rc.1 release (#3879) #3879 (github-actions[bot])
• update curlimages/curl to v8.12.0 (#3817) (Thomas Berreis)
• adding FAQs for multi-engine (#3761) (Jaydip Gabani)
• adding annotation to generate VAPB right away once the waiting window is over to protect against clock skews (#3773) (Jaydip Gabani)
• adding warning for alpha flags (#3764) (Jaydip Gabani)
• bump @babel/helpers from 7.17.8 to 7.26.10 in /website (#3856) (dependabot[bot])
• bump @babel/runtime from 7.18.6 to 7.26.10 in /website (#3855) (dependabot[bot])
• bump @babel/runtime-corejs3 from 7.18.6 to 7.26.10 in /website (#3848) (dependabot[bot])
• bump distroless/static-debian12 from 3f2b64e to 95ea148 (#3866) (dependabot[bot])
• bump distroless/static-debian12 from 3f2b64e to 95ea148 in /test/externaldata/dummy-provider (#3865) (dependabot[bot])
• bump distroless/static-debian12 from 5c7e2b4 to 3f2b64e in /test/externaldata/dummy-provider (#3775) (dependabot[bot])
• bump distroless/static-debian12 from f4a57e8 to 3f2b64e (#3774) (dependabot[bot])
• bump distroless/static-debian12 from f4a57e8 to 5c7e2b4 in /test/externaldata/dummy-provider (#3721) (dependabot[bot])
• bump frameworks and kube dep to 1.32.3 (#3873) (Jaydip Gabani)
• bump github.com/containerd/containerd from 1.7.25 to 1.7.27 (#3857) (dependabot[bot])
• bump github.com/golang/glog from 1.2.1 to 1.2.4 (#3802) (dependabot[bot])
• bump github.com/onsi/gomega from 1.34.1 to 1.34.2 (#3523) (dependabot[bot])
• bump github/codeql-action from 3.28.8 to 3.28.9 in the all group (#3813) (dependabot[bot])
• bump golang from 1.23-bookworm to 1.24-bookworm (#3821) (dependabot[bot])
• bump golang from 1.23-bookworm to 1.24-bookworm in /build/tooling (#3823) (dependabot[bot])
• bump golang from 1.23-bookworm to 1.24-bookworm in /test/externaldata/dummy-provider (#3824) (dependabot[bot])
• bump golang from 1.23-bookworm to 1.24-bookworm in /test/image (#3825) (dependabot[bot])
• bump golang from 2e83858 to 3149bc5 (#3793) (dependabot[bot])
• bump golang from 2e83858 to 3149bc5 in /test/externaldata/dummy-provider (#3794) (dependabot[bot])
• bump golang from 2e83858 to 3149bc5 in /test/image (#3791) (dependabot[bot])
• bump golang from 3149bc5 to 441f59f (#3812) (dependabot[bot])
• bump golang from 3149bc5 to 441f59f in /build/tooling (#3811) (dependabot[bot])
• bump golang from 3149bc5 to 441f59f in /test/externaldata/dummy-provider (#3815) (dependabot[bot])
• bump golang from 3149bc5 to 441f59f in /test/image (#3814) (dependabot[bot])
• bump golang from 3f3b9da to ef30001 (#3727) (dependabot[bot])
• bump golang from 3f3b9da to ef30001 in /build/tooling (#3726) (dependabot[bot])
• bump golang from 3f3b9da to ef30001 in /test/externaldata/dummy-provider (#3730) (dependabot[bot])
• bump golang from 6260304 to b970e6d in /build/tooling (#3834) (dependabot[bot])
• bump golang from 6260304 to b970e6d in /test/image (#3835) (dependabot[bot])
• bump golang from b970e6d to d7d795d (#3844) (dependabot[bot])
• bump golang from b970e6d to d7d795d in /build/tooling (#3841) (dependabot[bot])
• bump golang from b970e6d to d7d795d in /test/externaldata/dummy-provider (#3843) (dependabot[bot])
• b...